@indigoai-us/hq-cli 5.342.2 → 5.342.4

package/dist/lib/flag-registry-worker.js

@@ -20,7 +20,9 @@ async function refresh() {
             endpoint,
             ...(companyUid ? { companyUid } : {}),
             ...(companyIdentifiers.length ? { companyIdentifiers } : {}),
-            getToken: () => loadCachedTokens()?.idToken ?? "",
+            getToken: () => typeof data.idToken === "string" && data.idToken.length > 0
+                ? data.idToken
+                : loadCachedTokens()?.idToken ?? "",
             refreshIntervalMs: 0,
             onError: () => { },
         });
@@ -28,9 +30,12 @@ async function refresh() {
         const snapshot = client.snapshot();
         if (snapshot)
             parentPort.postMessage(snapshot);
+        else
+            parentPort.postMessage({ status: "snapshot_unavailable" });
     }
     catch {
         // The parent is deliberately fail-open and has the legacy fallback.
+        parentPort?.postMessage({ status: "snapshot_unavailable" });
     }
 }
 void refresh();

package/dist/lib/flag-registry.d.ts

@@ -15,11 +15,18 @@ export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 export type FlagReader = Pick<FlagClient, "isEnabled">;
 interface WorkerLike {
     on(event: "message", listener: (value: unknown) => void): unknown;
-    on(event: "error", listener: () => void): unknown;
+    on(event: "error", listener: (error: Error) => void): unknown;
+    ref?(): unknown;
     unref(): void;
 }
 export interface FlagRegistryDependencies {
     endpoint?: string;
+    /** An explicit `--company` scope, which takes precedence over ambient binding. */
+    companyScope?: string;
+    /** CLI argv used to resolve explicit company scope before the command parser runs. */
+    argv?: readonly string[];
+    /** Optional machine ID token already cached by the CLI, never logged or persisted. */
+    idToken?: string;
     createWorker?: (filename: string | URL, options: WorkerOptions) => WorkerLike;
     sentry?: FlagRegistrySentry;
     /** Test seam for exercising the no-source fail-open path. */
@@ -31,6 +38,10 @@ export interface CompanyFlagGateDependencies {
     requestTimeoutMs?: number;
     createClient?: typeof createFlagClient;
 }
+/** Extract only a CLI-level --company option; values after `--` belong to child commands. */
+export declare function explicitCompanyScopeFromArgv(argv: readonly string[]): string | undefined;
+/** Wait briefly for the current company refresh to persist or report completion. */
+export declare function waitForFlagRegistryRefresh(timeoutMs?: number, companyUid?: string): Promise<void>;
 /** Create the same snapshot-backed reader used by process gates. */
 export declare function createProcessSnapshotReader(companyIdentifiers: string[], getSnapshot?: () => FlagSnapshot | null, env?: NodeJS.ProcessEnv): FlagReader;
 /**

package/dist/lib/flag-registry.js

@@ -10,6 +10,7 @@ import { createFlagClient, isFlagSnapshot, readLocalOverride, resolveFlag, } fro
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
 import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
 import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
+import { registerFlagRegistryRefreshWaiter } from "./flag-registry-refresh-wait.js";
 import { writeFlagSnapshotFile } from "./flag-snapshot-file.js";
 function captureFlagRegistryException(error, tags, sentry) {
     if (!sentry)
@@ -19,12 +20,74 @@ function captureFlagRegistryException(error, tags, sentry) {
 export { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
 export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
+/** Extract only a CLI-level --company option; values after `--` belong to child commands. */
+export function explicitCompanyScopeFromArgv(argv) {
+    for (let index = 2; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === "--")
+            return undefined;
+        if (argument === "--company") {
+            const value = argv[index + 1]?.trim();
+            return value && !value.startsWith("-") ? value : undefined;
+        }
+        if (argument.startsWith("--company=")) {
+            const value = argument.slice("--company=".length).trim();
+            return value || undefined;
+        }
+    }
+    return undefined;
+}
 function normalizedCompanyUid(value) {
     const candidate = value?.trim() ?? "";
     return COMPANY_UID_RE.test(candidate) ? candidate : undefined;
 }
 let heldSnapshot = null;
 let processReader = null;
+let refreshCompletion = Promise.resolve();
+let completeRefresh = null;
+let refreshWorker = null;
+let refreshCompanyUid;
+let refreshPendingSnapshot = null;
+let refreshSentry;
+/** Wait briefly for the current company refresh to persist or report completion. */
+export async function waitForFlagRegistryRefresh(timeoutMs = 500, companyUid) {
+    const resolvedCompanyUid = normalizedCompanyUid(companyUid);
+    if (resolvedCompanyUid)
+        refreshCompanyUid = resolvedCompanyUid;
+    if (refreshPendingSnapshot && refreshCompanyUid) {
+        try {
+            writeFlagSnapshotFile(refreshCompanyUid, refreshPendingSnapshot.flags);
+        }
+        catch (error) {
+            captureFlagRegistryException(error instanceof Error ? error : new Error(String(error)), {
+                component: "flag-snapshot-cache-write",
+                company_uid_present: "true",
+            }, refreshSentry);
+        }
+        refreshPendingSnapshot = null;
+        completeRefresh?.();
+        completeRefresh = null;
+    }
+    if (!completeRefresh)
+        return;
+    const worker = refreshWorker;
+    worker?.ref?.();
+    let timer;
+    try {
+        await Promise.race([
+            refreshCompletion,
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, Math.max(0, timeoutMs));
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        worker?.unref();
+    }
+}
+registerFlagRegistryRefreshWaiter(waitForFlagRegistryRefresh);
 function processLocalOverride(flagKey, env = process.env) {
     return readLocalOverride(flagKey, env);
 }
@@ -61,10 +124,37 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
     if (processReader)
         return processReader;
     const endpoint = resolveFlagRegistryEndpoint(dependencies.endpoint, process.env);
-    const company = resolveProcessFlagCompanyContext();
+    const companyScope = dependencies.companyScope ?? explicitCompanyScopeFromArgv(dependencies.argv ?? []);
+    const companyEnv = companyScope
+        ? {
+            ...process.env,
+            HQ_COMPANY_UID: COMPANY_UID_RE.test(companyScope)
+                ? companyScope
+                : "",
+            HQ_COMPANY_SLUG: COMPANY_UID_RE.test(companyScope)
+                ? ""
+                : companyScope,
+        }
+        : process.env;
+    const company = resolveProcessFlagCompanyContext(companyEnv);
     const sentry = dependencies.sentry;
     const companyUid = company.companyUid;
     const companyIdentifiers = [companyUid, company.companySlug].filter((value) => Boolean(value));
+    refreshCompletion = Promise.resolve();
+    completeRefresh = null;
+    refreshWorker = null;
+    refreshCompanyUid = companyUid;
+    refreshPendingSnapshot = null;
+    refreshSentry = sentry;
+    if (companyUid || company.companySlug) {
+        refreshCompletion = new Promise((resolve) => {
+            completeRefresh = resolve;
+        });
+    }
+    const finishRefresh = () => {
+        completeRefresh?.();
+        completeRefresh = null;
+    };
     processReader = processSnapshotReader(companyIdentifiers);
     try {
         const embeddedSource = dependencies.workerSource ?? FLAG_REGISTRY_WORKER_SOURCE;
@@ -76,6 +166,7 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                 worker: "flag-registry",
                 flag_worker_failure: "embedded_source_unavailable",
             });
+            finishRefresh();
             return processReader;
         }
         // This source is embedded at build time, so it remains available while an
@@ -85,6 +176,9 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                 endpoint,
                 ...(companyUid ? { companyUid } : {}),
                 ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
+                ...((companyUid || company.companySlug) && dependencies.idToken
+                    ? { idToken: dependencies.idToken }
+                    : {}),
             },
             eval: true,
         };
@@ -100,12 +194,22 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                 return createWorker(embeddedSource, workerOptions);
             })
             : createWorker(embeddedSource, workerOptions);
+        refreshWorker = worker;
+        let released = false;
+        const releaseWorker = () => {
+            if (released)
+                return;
+            released = true;
+            worker.unref();
+        };
         worker.on("message", (value) => {
             if (isFlagSnapshot(value)) {
                 heldSnapshot = value;
-                if (companyUid) {
+                if (completeRefresh)
+                    refreshPendingSnapshot = value;
+                if (refreshCompanyUid && refreshPendingSnapshot) {
                     try {
-                        writeFlagSnapshotFile(companyUid, value.flags);
+                        writeFlagSnapshotFile(refreshCompanyUid, value.flags);
                     }
                     catch (error) {
                         captureFlagRegistryException(error instanceof Error ? error : new Error(String(error)), {
@@ -113,18 +217,28 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                             company_uid_present: "true",
                         }, sentry);
                     }
+                    refreshPendingSnapshot = null;
+                    finishRefresh();
                 }
             }
+            else {
+                finishRefresh();
+            }
+            releaseWorker();
         });
         // A failed background refresh must stay invisible to an offline CLI.
-        worker.on("error", () => { });
+        worker.on("error", () => {
+            finishRefresh();
+            releaseWorker();
+        });
         // Attach listeners first: Worker.on() re-refs the worker, so unref must be
         // last for the parent process to remain free to exit immediately.
-        worker.unref();
+        releaseWorker();
     }
     catch {
         // Construction can fail in restricted Node runtimes. The reader is still
         // safe: it has no snapshot, so it resolves through the legacy vocabulary.
+        finishRefresh();
     }
     return processReader;
 }
@@ -198,5 +312,11 @@ export function currentFlagSnapshot() {
 export function _resetFlagRegistryForTests() {
     heldSnapshot = null;
     processReader = null;
+    refreshCompletion = Promise.resolve();
+    completeRefresh = null;
+    refreshWorker = null;
+    refreshCompanyUid = undefined;
+    refreshPendingSnapshot = null;
+    refreshSentry = undefined;
 }
 //# sourceMappingURL=flag-registry.js.map

package/dist/main.js

@@ -37,7 +37,7 @@ import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
 import { isAuthError } from "./utils/auth-error.js";
 import { browserLoginAbandonedMessage } from "./utils/browser-login-abandoned.js";
 import { callbackPortBusyMessage, DEFAULT_CALLBACK_PORT } from "./utils/callback-port-busy.js";
-import { DEFAULT_COGNITO } from "./utils/cognito-session.js";
+import { DEFAULT_COGNITO, isMachineIdentity, loadMachineCachedTokens, } from "./utils/cognito-session.js";
 import { isCompanySelectionError } from "./utils/company-selection-error.js";
 import { canOfferTeamUpgrade, formatPlanGateError, offerTeamUpgrade, offerUpgradeLink, planGateErrorFromVaultError, } from "./utils/plan-gate-error.js";
 import { upgradeToTeam } from "./utils/team-upgrade.js";
@@ -53,6 +53,7 @@ import { emitPlanLimitNag } from "./lib/plan-limit-nag.js";
 import { kickFlagRegistryReadiness } from "./lib/flag-registry.js";
 import { isPackageRootResolutionError, packageRootCaptureContext, } from "./utils/package-root-diagnostics.js";
 import { registerCommandsWithRecovery } from "./startup-registration.js";
+import { releasePackageUseLeaseAfterCommandLoad } from "./utils/package-use-lease.js";
 import { installTreeTornCaptureContext, installTreeTornStderrLine, isInstallTreeTornError, } from "./utils/install-tree-torn.js";
 import { isVaultAccessDeniedError, vaultAccessDeniedMessage, } from "./utils/vault-access-denied-error.js";
 import { fallbackOperatorMessage, unexpectedCliErrorMessage } from "./utils/unexpected-cli-error.js";
@@ -170,7 +171,13 @@ export async function runCli() {
     const isAuthLogin = process.argv[2] === "auth" && process.argv[3] === "login";
     if (!isAuthLogin) {
         runGlobalNetworkLifecycle(process.argv, () => {
-            void kickFlagRegistryReadiness({ sentry: Sentry });
+            void kickFlagRegistryReadiness({
+                sentry: Sentry,
+                argv: process.argv,
+                ...(isMachineIdentity()
+                    ? { idToken: loadMachineCachedTokens()?.idToken }
+                    : {}),
+            });
         });
     }
     // Set when a self-update re-exec'd this command on a newer CLI: the child
@@ -255,6 +262,7 @@ export async function runCli() {
             reexecStatus = registration.reexecStatus;
             return;
         }
+        await releasePackageUseLeaseAfterCommandLoad(process.argv);
         await program.parseAsync();
         maybeShowFirstSyncNextStep();
     }

package/dist/secrets-env-action.js

@@ -6,6 +6,7 @@ import { isAuthError } from "./utils/auth-error.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntry, writeCache, } from "./utils/secrets-cache.js";
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
+import { finishEnvExportsAndExit } from "./commands/secrets-env-exit.js";
 import { getEntityUid, vaultApiFetch } from "./utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, resolveVaultCredentialForCapability, } from "./utils/resolve-vault-credential.js";
 import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "./utils/secret-load-availability.js";
@@ -436,10 +437,9 @@ export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
             const out = redact ? "[REDACTED]" : value;
             payload += `export ${key}=${shellSingleQuote(out)}\n`;
         }
-        // Write synchronously and exit unconditionally — never depend on the
-        // event loop draining or the stdout write callback firing. See
-        // emitEnvExportsAndExit for the full rationale (orphaned-process leak).
-        emitEnvExportsAndExit(payload);
+        // Persist an already-running company snapshot before the synchronous
+        // export write exits the process. Personal exports do not wait.
+        await finishEnvExportsAndExit(payload, undefined, process.exit, undefined, !parentScope.personal, companyUid);
         return "handled";
     }
     catch (err) {

package/dist/utils/package-use-lease.d.ts

@@ -16,6 +16,12 @@ export declare function packageUseUpdateRequestPath(prefix: string, stateDirecto
 declare function waitForUpdateRequest(requestPath: string, timeoutMs: number): void;
 export declare function acquirePackageUseLease(prefix: string, hqVersion: string, stateDirectory?: string): PackageUseLease;
 export declare function acquireCurrentPackageUseLease(): PackageUseLease | null;
+/** Release this process's package-use lease after a long-running command has loaded its package modules. */
+export declare function releaseCurrentPackageUseLease(): void;
+/** The lease remains held through command execution and is released on process exit. */
+export declare function releasePackageUseLeaseAfterCommandLoad(_argv?: readonly string[], _release?: () => void): void;
+/** Release only after a command-specific preload succeeds; failures are reported and keep the lease. */
+export declare function releasePackageUseLeaseAfterResidentPreload(preload: () => Promise<void>, reportFailure: (error: unknown) => void, release?: () => void): Promise<void>;
 /** True only when a valid update request belongs to a live updater process. */
 export declare function packageUseUpdatePending(prefix: string, stateDirectory?: string): boolean;
 /** True while the desktop updater owns the per-prefix update request. */

package/dist/utils/package-use-lease.js

@@ -12,6 +12,7 @@ export class PackageUseUpdatePendingError extends Error {
         this.name = "PackageUseUpdatePendingError";
     }
 }
+let currentPackageUseLease = null;
 function errorLabel(error) {
     if (error && typeof error === "object") {
         const value = error;
@@ -195,7 +196,29 @@ export function acquireCurrentPackageUseLease() {
         if (nodeModules > 0 && parts[nodeModules - 1] !== "lib")
             return null;
     }
-    return acquirePackageUseLease(prefix, pkg.version);
+    const lease = acquirePackageUseLease(prefix, pkg.version);
+    currentPackageUseLease = lease;
+    return lease;
+}
+/** Release this process's package-use lease after a long-running command has loaded its package modules. */
+export function releaseCurrentPackageUseLease() {
+    currentPackageUseLease?.release();
+    currentPackageUseLease = null;
+}
+/** The lease remains held through command execution and is released on process exit. */
+export function releasePackageUseLeaseAfterCommandLoad(_argv = process.argv, _release = releaseCurrentPackageUseLease) {
+    // The package-use lease's process-exit listener owns its normal release.
+}
+/** Release only after a command-specific preload succeeds; failures are reported and keep the lease. */
+export async function releasePackageUseLeaseAfterResidentPreload(preload, reportFailure, release = releaseCurrentPackageUseLease) {
+    try {
+        await preload();
+    }
+    catch (error) {
+        reportFailure(error);
+        return;
+    }
+    release();
 }
 /** True only when a valid update request belongs to a live updater process. */
 export function packageUseUpdatePending(prefix, stateDirectory) {

package/dist/utils/resident-package-preload.d.ts

@@ -0,0 +1,13 @@
+export type ResidentPackagePath = "bot" | "mcp";
+/** Package imports reachable lazily from each resident command's runtime graph. */
+export declare const RESIDENT_PACKAGE_MODULES: Record<ResidentPackagePath, readonly string[]>;
+export declare class ResidentPackagePreloadError extends Error {
+    readonly moduleSpecifier: string;
+    readonly errorClass: string;
+    constructor(moduleSpecifier: string, errorClass: string);
+}
+/** Report only bounded runtime metadata; never include an exception message or path. */
+export declare function reportResidentPackagePreloadFailure(error: unknown): void;
+/** Resolve every lazy package module before a resident command releases its lease. */
+export declare function preloadResidentPackageModules(residentPath: ResidentPackagePath, load?: () => Promise<unknown>): Promise<void>;
+//# sourceMappingURL=resident-package-preload.d.ts.map

package/dist/utils/resident-package-preload.js

@@ -0,0 +1,78 @@
+/** Package imports reachable lazily from each resident command's runtime graph. */
+export const RESIDENT_PACKAGE_MODULES = {
+    bot: ["../lib/flag-registry.js", "../commands/access.js", "../sentry.js", "open"],
+    mcp: [
+        "../lib/mcp/tools.js",
+        "../lib/mcp/prompts.js",
+        "../utils/cognito-session.js",
+        "../lib/daemon/mcp-oauth.js",
+        "../commands/access.js",
+        "../lib/flag-registry.js",
+        "@modelcontextprotocol/sdk/client/index.js",
+        "@modelcontextprotocol/sdk/client/streamableHttp.js",
+        "../sentry.js",
+        "open",
+        "./staged-npm-install.js",
+    ],
+};
+const LOADERS = {
+    bot: [
+        () => import("../lib/flag-registry.js"),
+        () => import("../commands/access.js"),
+        () => import("../sentry.js"),
+        () => import("open"),
+    ],
+    mcp: [
+        () => import("../lib/mcp/tools.js"),
+        () => import("../lib/mcp/prompts.js"),
+        () => import("../utils/cognito-session.js"),
+        () => import("../lib/daemon/mcp-oauth.js"),
+        () => import("../commands/access.js"),
+        () => import("../lib/flag-registry.js"),
+        () => import("@modelcontextprotocol/sdk/client/index.js"),
+        () => import("@modelcontextprotocol/sdk/client/streamableHttp.js"),
+        () => import("../sentry.js"),
+        () => import("open"),
+        () => import("./staged-npm-install.js"),
+    ],
+};
+export class ResidentPackagePreloadError extends Error {
+    moduleSpecifier;
+    errorClass;
+    constructor(moduleSpecifier, errorClass) {
+        super("Resident package module preload failed");
+        this.moduleSpecifier = moduleSpecifier;
+        this.errorClass = errorClass;
+        this.name = "ResidentPackagePreloadError";
+    }
+}
+function boundedErrorClass(error) {
+    const value = error && typeof error === "object"
+        ? error
+        : {};
+    const label = typeof value.code === "string" ? value.code : typeof value.name === "string" ? value.name : "Error";
+    return /^[A-Za-z][A-Za-z0-9_]{0,39}$/.test(label) ? label : "Error";
+}
+/** Report only bounded runtime metadata; never include an exception message or path. */
+export function reportResidentPackagePreloadFailure(error) {
+    const failure = error instanceof ResidentPackagePreloadError
+        ? error
+        : new ResidentPackagePreloadError("unknown", boundedErrorClass(error));
+    process.stderr.write(`hq-cli resident package preload failed (class=${failure.errorClass}, module=${failure.moduleSpecifier})\n`);
+}
+/** Resolve every lazy package module before a resident command releases its lease. */
+export async function preloadResidentPackageModules(residentPath, load) {
+    if (load) {
+        await load();
+        return;
+    }
+    await Promise.all(LOADERS[residentPath].map(async (loader, index) => {
+        try {
+            await loader();
+        }
+        catch (error) {
+            throw new ResidentPackagePreloadError(RESIDENT_PACKAGE_MODULES[residentPath][index] ?? "unknown", boundedErrorClass(error));
+        }
+    }));
+}
+//# sourceMappingURL=resident-package-preload.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.2",
+  "version": "5.342.4",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {